">" -> ">=" for EXIM_CLIENT_DH_MIN_BITS+10
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
17c76198 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
059ec3d9 42
17c76198 43/* GnuTLS 2 vs 3
059ec3d9 44
17c76198
PP
45GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
059ec3d9 47
17c76198
PP
48Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50*/
059ec3d9 51
17c76198 52/* Local static variables for GnuTLS */
059ec3d9 53
17c76198 54/* Values for verify_requirement */
059ec3d9 55
17c76198 56enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 57
17c76198
PP
58/* This holds most state for server or client; with this, we can set up an
59outbound TLS-enabled connection in an ACL callout, while not stomping all
60over the TLS variables available for expansion.
059ec3d9 61
17c76198
PP
62Some of these correspond to variables in globals.c; those variables will
63be set to point to content in one of these instances, as appropriate for
64the stage of the process lifetime.
059ec3d9 65
17c76198
PP
66Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67tls_certificate_verified, tls_channelbinding_b64, tls_sni.
68*/
059ec3d9 69
17c76198
PP
70typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
75 int fd_in;
76 int fd_out;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
4fe99a6c 79 BOOL have_set_peerdn;
17c76198
PP
80 const struct host_item *host;
81 uschar *peerdn;
75fe387d 82 uschar *ciphersuite;
17c76198
PP
83 uschar *received_sni;
84
85 const uschar *tls_certificate;
86 const uschar *tls_privatekey;
87 const uschar *tls_sni; /* client send only, not received */
88 const uschar *tls_verify_certificates;
89 const uschar *tls_crl;
90 const uschar *tls_require_ciphers;
91 uschar *exp_tls_certificate;
92 uschar *exp_tls_privatekey;
93 uschar *exp_tls_sni;
94 uschar *exp_tls_verify_certificates;
95 uschar *exp_tls_crl;
96 uschar *exp_tls_require_ciphers;
97
98 uschar *xfer_buffer;
99 int xfer_buffer_lwm;
100 int xfer_buffer_hwm;
101 int xfer_eof;
102 int xfer_error;
17c76198
PP
103} exim_gnutls_state_st;
104
105static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 107 NULL, NULL, NULL, NULL,
17c76198
PP
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, 0, 0, 0, 0,
17c76198 111};
83da1223 112
17c76198
PP
113/* Not only do we have our own APIs which don't pass around state, assuming
114it's held in globals, GnuTLS doesn't appear to let us register callback data
115for callbacks, or as part of the session, so we have to keep a "this is the
116context we're currently dealing with" pointer and rely upon being
117single-threaded to keep from processing data on an inbound TLS connection while
118talking to another TLS connection for an outbound check. This does mean that
119there's no way for heart-beats to be responded to, for the duration of the
120second connection. */
059ec3d9 121
17c76198
PP
122static exim_gnutls_state_st state_server, state_client;
123static exim_gnutls_state_st *current_global_tls_state;
059ec3d9 124
17c76198
PP
125/* dh_params are initialised once within the lifetime of a process using TLS;
126if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
127don't want to repeat this. */
83da1223 128
17c76198 129static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 130
17c76198 131/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 132
17c76198 133static const int ssl_session_timeout = 200;
059ec3d9 134
17c76198 135static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 136
17c76198 137/* Guard library core initialisation */
83da1223 138
17c76198 139static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 140
059ec3d9 141
17c76198 142/* ------------------------------------------------------------------------ */
17c76198 143/* macros */
83da1223 144
17c76198 145#define MAX_HOST_LEN 255
83da1223 146
17c76198
PP
147/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
148the library logging; a value less than 0 disables the calls to set up logging
149callbacks. */
2c17bb02 150#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 151#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 152#endif
83da1223 153
2c17bb02 154#ifndef EXIM_CLIENT_DH_MIN_BITS
17c76198 155#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 156#endif
83da1223 157
af3498d6
PP
158/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
159can ask for a bit-strength. Without that, we stick to the constant we had
160before, for now. */
2c17bb02 161#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 162#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 163#endif
af3498d6 164
17c76198
PP
165#define exim_gnutls_err_check(Label) do { \
166 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 167
17c76198 168#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 169
17c76198
PP
170#if GNUTLS_VERSION_NUMBER >= 0x020c00
171#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
172#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173#define HAVE_GNUTLS_RND
17c76198 174#endif
83da1223 175
af3498d6
PP
176
177
178
179/* ------------------------------------------------------------------------ */
180/* Callback declarations */
181
182#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183static void exim_gnutls_logger_cb(int level, const char *message);
184#endif
185
186static int exim_sni_handling_cb(gnutls_session_t session);
187
188
189
190
17c76198
PP
191/* ------------------------------------------------------------------------ */
192/* Static functions */
059ec3d9
PH
193
194/*************************************************
195* Handle TLS error *
196*************************************************/
197
198/* Called from lots of places when errors occur before actually starting to do
199the TLS handshake, that is, while the session is still in clear. Always returns
200DEFER for a server and FAIL for a client so that most calls can use "return
201tls_error(...)" to do this processing and then give an appropriate return. A
202single function is used for both server and client, because it is called from
203some shared functions.
204
205Argument:
206 prefix text to include in the logged error
7199e1ee
TF
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
17c76198
PP
209 host NULL if setting up a server;
210 the connected host if setting up a client
059ec3d9
PH
211
212Returns: OK/DEFER/FAIL
213*/
214
215static int
17c76198 216tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 217{
17c76198
PP
218if (host)
219 {
220 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
221 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
222 return FAIL;
223 }
224else
059ec3d9 225 {
7199e1ee 226 uschar *conn_info = smtp_get_connection_info();
17c76198 227 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
228 conn_info += 5;
229 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 230 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
231 return DEFER;
232 }
059ec3d9
PH
233}
234
235
236
17c76198 237
059ec3d9 238/*************************************************
17c76198 239* Deal with logging errors during I/O *
059ec3d9
PH
240*************************************************/
241
17c76198 242/* We have to get the identity of the peer from saved data.
059ec3d9 243
17c76198
PP
244Argument:
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
059ec3d9 249
17c76198 250Returns: nothing
059ec3d9
PH
251*/
252
17c76198
PP
253static void
254record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 255{
17c76198 256const char *msg;
059ec3d9 257
17c76198
PP
258if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
259 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
260 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
261else
262 msg = gnutls_strerror(rc);
059ec3d9 263
17c76198
PP
264tls_error(when, msg, state->host);
265}
059ec3d9 266
059ec3d9 267
059ec3d9 268
059ec3d9 269
17c76198
PP
270/*************************************************
271* Set various Exim expansion vars *
272*************************************************/
059ec3d9 273
17c76198
PP
274/* We set various Exim global variables from the state, once a session has
275been established. With TLS callouts, may need to change this to stack
276variables, or just re-call it with the server state after client callout
277has finished.
059ec3d9 278
17c76198
PP
279Make sure anything set here is inset in tls_getc().
280
281Sets:
282 tls_active fd
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
286 tls_cipher a string
287 tls_peerdn a string
288 tls_sni a (UTF-8) string
289Also:
290 current_global_tls_state for API limitations
291
292Argument:
293 state the relevant exim_gnutls_state_st *
294*/
295
296static void
297extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
298{
17c76198 299gnutls_cipher_algorithm_t cipher;
17c76198
PP
300#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
301int old_pool;
302int rc;
303gnutls_datum_t channel;
304#endif
305
306current_global_tls_state = state;
307
308tls_active = state->fd_out;
309
310cipher = gnutls_cipher_get(state->session);
311/* returns size in "bytes" */
312tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
313
75fe387d 314tls_cipher = state->ciphersuite;
17c76198
PP
315
316DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
317
318tls_certificate_verified = state->peer_cert_verified;
059ec3d9 319
17c76198
PP
320/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
321only available for use for authenticators while this TLS session is running. */
322
323tls_channelbinding_b64 = NULL;
324#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
325channel.data = NULL;
326channel.size = 0;
327rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
328if (rc) {
329 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
330} else {
331 old_pool = store_pool;
332 store_pool = POOL_PERM;
333 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
334 store_pool = old_pool;
335 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
336}
337#endif
338
339tls_peerdn = state->peerdn;
340
341tls_sni = state->received_sni;
059ec3d9
PH
342}
343
344
345
17c76198 346
059ec3d9 347/*************************************************
575643cd 348* Setup up DH parameters *
059ec3d9
PH
349*************************************************/
350
575643cd 351/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
352be re-generated every so often, depending on security policy. What we do is to
353keep these parameters in a file in the spool directory. If the file does not
354exist, we generate them. This means that it is easy to cause a regeneration.
355
356The new file is written as a temporary file and renamed, so that an incomplete
357file is never present. If two processes both compute some new parameters, you
358waste a bit of effort, but it doesn't seem worth messing around with locking to
359prevent this.
360
361Argument:
362 host NULL for server, server for client (for error handling)
363
364Returns: OK/DEFER/FAIL
365*/
366
367static int
17c76198 368init_server_dh(void)
059ec3d9 369{
17c76198
PP
370int fd, rc;
371unsigned int dh_bits;
b5aea5e1 372gnutls_datum m;
17c76198
PP
373uschar filename[PATH_MAX];
374size_t sz;
375host_item *host = NULL; /* dummy for macros */
059ec3d9 376
17c76198 377DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 378
17c76198
PP
379rc = gnutls_dh_params_init(&dh_server_params);
380exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 381
af3498d6
PP
382#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
383/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
384different filename and ensure we have sufficient bits. */
385dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
386if (!dh_bits)
387 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 388DEBUG(D_tls)
b34fc30c 389 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
390 dh_bits);
391#else
392dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
393DEBUG(D_tls)
394 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
395 dh_bits);
396#endif
059ec3d9 397
3375e053
PP
398/* Some clients have hard-coded limits. */
399if (dh_bits > tls_dh_max_bits)
400 {
401 DEBUG(D_tls)
402 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
403 tls_dh_max_bits);
404 dh_bits = tls_dh_max_bits;
405 }
406
17c76198 407if (!string_format(filename, sizeof(filename),
af3498d6 408 "%s/gnutls-params-%d", spool_directory, dh_bits))
17c76198 409 return tls_error(US"overlong filename", NULL, NULL);
059ec3d9 410
b5aea5e1 411/* Open the cache file for reading and if successful, read it and set up the
575643cd 412parameters. */
059ec3d9
PH
413
414fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 415if (fd >= 0)
059ec3d9 416 {
b5aea5e1 417 struct stat statbuf;
17c76198
PP
418 FILE *fp;
419 int saved_errno;
420
421 if (fstat(fd, &statbuf) < 0) /* EIO */
422 {
423 saved_errno = errno;
424 (void)close(fd);
425 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
426 }
427 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
428 {
429 (void)close(fd);
17c76198
PP
430 return tls_error(US"TLS cache not a file", NULL, NULL);
431 }
432 fp = fdopen(fd, "rb");
433 if (!fp)
434 {
435 saved_errno = errno;
436 (void)close(fd);
437 return tls_error(US"fdopen(TLS cache stat fd) failed",
438 strerror(saved_errno), NULL);
b5aea5e1 439 }
059ec3d9 440
b5aea5e1
PH
441 m.size = statbuf.st_size;
442 m.data = malloc(m.size);
443 if (m.data == NULL)
17c76198
PP
444 {
445 fclose(fp);
446 return tls_error(US"malloc failed", strerror(errno), NULL);
447 }
448 sz = fread(m.data, m.size, 1, fp);
449 if (!sz)
450 {
451 saved_errno = errno;
452 fclose(fp);
453 free(m.data);
454 return tls_error(US"fread failed", strerror(saved_errno), NULL);
455 }
456 fclose(fp);
b5aea5e1 457
17c76198 458 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 459 free(m.data);
17c76198
PP
460 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
461 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
462 }
463
464/* If the file does not exist, fall through to compute new data and cache it.
465If there was any other opening error, it is serious. */
466
182ad5cf
PH
467else if (errno == ENOENT)
468 {
17c76198 469 rc = -1;
182ad5cf 470 DEBUG(D_tls)
17c76198 471 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
472 }
473else
17c76198
PP
474 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
475 NULL, NULL);
b5aea5e1
PH
476
477/* If ret < 0, either the cache file does not exist, or the data it contains
478is not useful. One particular case of this is when upgrading from an older
479release of Exim in which the data was stored in a different format. We don't
480try to be clever and support both formats; we just regenerate new data in this
481case. */
482
17c76198 483if (rc < 0)
b5aea5e1 484 {
17c76198 485 uschar *temp_fn;
201f5254 486 unsigned int dh_bits_gen = dh_bits;
059ec3d9 487
17c76198
PP
488 if ((PATH_MAX - Ustrlen(filename)) < 10)
489 return tls_error(US"Filename too long to generate replacement",
490 CS filename, NULL);
059ec3d9 491
17c76198
PP
492 temp_fn = string_copy(US "%s.XXXXXXX");
493 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 494 if (fd < 0)
17c76198 495 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
496 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
497
201f5254
PP
498 /* GnuTLS overshoots!
499 * If we ask for 2236, we might get 2237 or more.
500 * But there's no way to ask GnuTLS how many bits there really are.
501 * We can ask how many bits were used in a TLS session, but that's it!
502 * The prime itself is hidden behind too much abstraction.
503 * So we ask for less, and proceed on a wing and a prayer.
504 * First attempt, subtracted 3 for 2233 and got 2240.
505 */
cae6e576 506 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
507 {
508 dh_bits_gen = dh_bits - 10;
509 DEBUG(D_tls)
510 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
511 dh_bits_gen);
512 }
513
514 DEBUG(D_tls)
515 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
516 dh_bits_gen);
517 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
518 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
519
520 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
521 and I confirmed that a NULL call to get the size first is how the GnuTLS
522 sample apps handle this. */
523
524 sz = 0;
525 m.data = NULL;
526 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
527 m.data, &sz);
528 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
529 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
530 m.size = sz;
b5aea5e1
PH
531 m.data = malloc(m.size);
532 if (m.data == NULL)
17c76198 533 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 534 /* this will return a size 1 less than the allocation size above */
17c76198 535 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 536 m.data, &sz);
17c76198
PP
537 if (rc != GNUTLS_E_SUCCESS)
538 {
539 free(m.data);
540 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
541 }
1f00591e 542 m.size = sz; /* shrink by 1, probably */
059ec3d9 543
17c76198
PP
544 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
545 if (sz != m.size)
546 {
547 free(m.data);
548 return tls_error(US"TLS cache write D-H params failed",
549 strerror(errno), NULL);
550 }
b5aea5e1 551 free(m.data);
17c76198
PP
552 sz = write_to_fd_buf(fd, US"\n", 1);
553 if (sz != 1)
554 return tls_error(US"TLS cache write D-H params final newline failed",
555 strerror(errno), NULL);
556
557 rc = close(fd);
558 if (rc)
559 return tls_error(US"TLS cache write close() failed",
560 strerror(errno), NULL);
059ec3d9 561
17c76198
PP
562 if (Urename(temp_fn, filename) < 0)
563 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
564 temp_fn, filename), strerror(errno), NULL);
059ec3d9 565
17c76198 566 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
567 }
568
17c76198 569DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
570return OK;
571}
572
573
574
575
576/*************************************************
17c76198 577* Variables re-expanded post-SNI *
059ec3d9
PH
578*************************************************/
579
17c76198
PP
580/* Called from both server and client code, via tls_init(), and also from
581the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
582
583We can tell the two apart by state->received_sni being non-NULL in callback.
584
585The callback should not call us unless state->trigger_sni_changes is true,
586which we are responsible for setting on the first pass through.
059ec3d9
PH
587
588Arguments:
17c76198 589 state exim_gnutls_state_st *
059ec3d9
PH
590
591Returns: OK/DEFER/FAIL
592*/
593
594static int
17c76198 595tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 596{
1365611d 597struct stat statbuf;
059ec3d9 598int rc;
17c76198
PP
599const host_item *host = state->host; /* macro should be reconsidered? */
600uschar *saved_tls_certificate = NULL;
601uschar *saved_tls_privatekey = NULL;
602uschar *saved_tls_verify_certificates = NULL;
603uschar *saved_tls_crl = NULL;
604int cert_count;
605
606/* We check for tls_sni *before* expansion. */
607if (!state->host)
608 {
609 if (!state->received_sni)
610 {
619b2b25 611 if (state->tls_certificate && Ustrstr(state->tls_certificate, US"tls_sni"))
17c76198
PP
612 {
613 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
614 state->trigger_sni_changes = TRUE;
615 }
616 }
617 else
618 {
1365611d 619 /* useful for debugging */
17c76198
PP
620 saved_tls_certificate = state->exp_tls_certificate;
621 saved_tls_privatekey = state->exp_tls_privatekey;
622 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
623 saved_tls_crl = state->exp_tls_crl;
624 }
625 }
059ec3d9 626
1365611d
PP
627rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
628exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
629
17c76198
PP
630/* remember: expand_check_tlsvar() is expand_check() but fiddling with
631state members, assuming consistent naming; and expand_check() returns
632false if expansion failed, unless expansion was forced to fail. */
059ec3d9 633
17c76198
PP
634/* check if we at least have a certificate, before doing expensive
635D-H generation. */
059ec3d9 636
17c76198
PP
637if (!expand_check_tlsvar(tls_certificate))
638 return DEFER;
059ec3d9 639
17c76198 640/* certificate is mandatory in server, optional in client */
059ec3d9 641
17c76198
PP
642if ((state->exp_tls_certificate == NULL) ||
643 (*state->exp_tls_certificate == '\0'))
644 {
645 if (state->host == NULL)
646 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
647 else
648 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
649 }
059ec3d9 650
17c76198 651if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
652 return DEFER;
653
17c76198
PP
654/* tls_privatekey is optional, defaulting to same file as certificate */
655
656if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 657 {
17c76198
PP
658 state->tls_privatekey = state->tls_certificate;
659 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 660 }
c91535f3 661
059ec3d9 662
17c76198 663if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
664 {
665 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
666 state->exp_tls_certificate, state->exp_tls_privatekey);
667
668 if (state->received_sni)
de365ded 669 {
17c76198
PP
670 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
671 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
672 {
b34fc30c 673 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
674 }
675 else
676 {
b34fc30c 677 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 678 }
8e669ac1 679 }
059ec3d9 680
1365611d
PP
681 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
682 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
683 GNUTLS_X509_FMT_PEM);
684 exim_gnutls_err_check(
685 string_sprintf("cert/key setup: cert=%s key=%s",
686 state->exp_tls_certificate, state->exp_tls_privatekey));
687 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 688 } /* tls_certificate */
059ec3d9
PH
689
690/* Set the trusted CAs file if one is provided, and then add the CRL if one is
691provided. Experiment shows that, if the certificate file is empty, an unhelpful
692error message is provided. However, if we just refrain from setting anything up
693in that case, certificate verification fails, which seems to be the correct
694behaviour. */
695
17c76198 696if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 697 {
17c76198 698 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 699 return DEFER;
17c76198
PP
700 if (state->tls_crl && *state->tls_crl)
701 if (!expand_check_tlsvar(tls_crl))
702 return DEFER;
059ec3d9 703
1365611d
PP
704 if (!(state->exp_tls_verify_certificates &&
705 *state->exp_tls_verify_certificates))
b34fc30c
PP
706 {
707 DEBUG(D_tls)
1365611d
PP
708 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
709 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 710 return OK;
b34fc30c 711 }
1365611d 712 }
83e2f8a2
PP
713else
714 {
715 DEBUG(D_tls)
716 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
717 return OK;
718 }
17c76198 719
1365611d
PP
720if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
721 {
722 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
723 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
724 strerror(errno));
725 return DEFER;
726 }
17c76198 727
619b2b25
PP
728/* The test suite passes in /dev/null; we could check for that path explicitly,
729but who knows if someone has some weird FIFO which always dumps some certs, or
730other weirdness. The thing we really want to check is that it's not a
731directory, since while OpenSSL supports that, GnuTLS does not.
732So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
733if (S_ISDIR(statbuf.st_mode))
1365611d
PP
734 {
735 DEBUG(D_tls)
619b2b25
PP
736 debug_printf("verify certificates path is a dir: \"%s\"\n",
737 state->exp_tls_verify_certificates);
1365611d 738 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 739 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
740 state->exp_tls_verify_certificates);
741 return DEFER;
742 }
059ec3d9 743
1365611d
PP
744DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
745 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 746
1365611d
PP
747if (statbuf.st_size == 0)
748 {
749 DEBUG(D_tls)
750 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
751 return OK;
752 }
059ec3d9 753
1365611d
PP
754cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
755 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
756if (cert_count < 0)
757 {
758 rc = cert_count;
759 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
760 }
761DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 762
5c8cda3a
PP
763if (state->tls_crl && *state->tls_crl &&
764 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 765 {
5c8cda3a
PP
766 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
767 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
768 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
769 if (cert_count < 0)
1365611d 770 {
5c8cda3a 771 rc = cert_count;
1365611d
PP
772 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
773 }
5c8cda3a 774 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 775 }
059ec3d9 776
059ec3d9
PH
777return OK;
778}
779
780
781
782
783/*************************************************
1365611d
PP
784* Set X.509 state variables *
785*************************************************/
786
787/* In GnuTLS, the registered cert/key are not replaced by a later
788set of a cert/key, so for SNI support we need a whole new x509_cred
789structure. Which means various other non-re-expanded pieces of state
790need to be re-set in the new struct, so the setting logic is pulled
791out to this.
792
793Arguments:
794 state exim_gnutls_state_st *
795
796Returns: OK/DEFER/FAIL
797*/
798
799static int
800tls_set_remaining_x509(exim_gnutls_state_st *state)
801{
802int rc;
803const host_item *host = state->host; /* macro should be reconsidered? */
804
805/* Create D-H parameters, or read them from the cache file. This function does
806its own SMTP error messaging. This only happens for the server, TLS D-H ignores
807client-side params. */
808
809if (!state->host)
810 {
811 if (!dh_server_params)
812 {
813 rc = init_server_dh();
814 if (rc != OK) return rc;
815 }
816 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
817 }
818
819/* Link the credentials to the session. */
820
821rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
822exim_gnutls_err_check(US"gnutls_credentials_set");
823
824return OK;
825}
826
827/*************************************************
17c76198 828* Initialize for GnuTLS *
059ec3d9
PH
829*************************************************/
830
17c76198
PP
831/* Called from both server and client code. In the case of a server, errors
832before actual TLS negotiation return DEFER.
059ec3d9
PH
833
834Arguments:
17c76198
PP
835 host connected host, if client; NULL if server
836 certificate certificate file
837 privatekey private key file
838 sni TLS SNI to send, sometimes when client; else NULL
839 cas CA certs file
840 crl CRL file
841 require_ciphers tls_require_ciphers setting
059ec3d9 842
17c76198 843Returns: OK/DEFER/FAIL
059ec3d9
PH
844*/
845
17c76198
PP
846static int
847tls_init(
848 const host_item *host,
849 const uschar *certificate,
850 const uschar *privatekey,
851 const uschar *sni,
852 const uschar *cas,
853 const uschar *crl,
854 const uschar *require_ciphers,
855 exim_gnutls_state_st **caller_state)
059ec3d9 856{
17c76198
PP
857exim_gnutls_state_st *state;
858int rc;
859size_t sz;
860const char *errpos;
861uschar *p;
862BOOL want_default_priorities;
863
864if (!exim_gnutls_base_init_done)
059ec3d9 865 {
17c76198
PP
866 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
867
868 rc = gnutls_global_init();
869 exim_gnutls_err_check(US"gnutls_global_init");
870
871#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
872 DEBUG(D_tls)
059ec3d9 873 {
17c76198
PP
874 gnutls_global_set_log_function(exim_gnutls_logger_cb);
875 /* arbitrarily chosen level; bump upto 9 for more */
876 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 877 }
17c76198
PP
878#endif
879
880 exim_gnutls_base_init_done = TRUE;
059ec3d9 881 }
059ec3d9 882
17c76198
PP
883if (host)
884 {
885 state = &state_client;
886 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
887 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
888 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
889 }
890else
891 {
892 state = &state_server;
893 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
894 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
895 rc = gnutls_init(&state->session, GNUTLS_SERVER);
896 }
897exim_gnutls_err_check(US"gnutls_init");
059ec3d9 898
17c76198 899state->host = host;
059ec3d9 900
17c76198
PP
901state->tls_certificate = certificate;
902state->tls_privatekey = privatekey;
5779e6aa 903state->tls_require_ciphers = require_ciphers;
17c76198
PP
904state->tls_sni = sni;
905state->tls_verify_certificates = cas;
906state->tls_crl = crl;
059ec3d9 907
17c76198
PP
908/* This handles the variables that might get re-expanded after TLS SNI;
909that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 910
17c76198
PP
911DEBUG(D_tls)
912 debug_printf("Expanding various TLS configuration options for session credentials.\n");
913rc = tls_expand_session_files(state);
914if (rc != OK) return rc;
059ec3d9 915
1365611d
PP
916/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
917requires a new structure afterwards. */
83da1223 918
1365611d
PP
919rc = tls_set_remaining_x509(state);
920if (rc != OK) return rc;
83da1223 921
17c76198
PP
922/* set SNI in client, only */
923if (host)
924 {
925 if (!expand_check_tlsvar(tls_sni))
926 return DEFER;
927 if (state->exp_tls_sni && *state->exp_tls_sni)
928 {
929 DEBUG(D_tls)
930 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
931 sz = Ustrlen(state->exp_tls_sni);
932 rc = gnutls_server_name_set(state->session,
933 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
934 exim_gnutls_err_check(US"gnutls_server_name_set");
935 }
936 }
937else if (state->tls_sni)
938 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
939 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 940
17c76198
PP
941/* This is the priority string support,
942http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
943and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
944This was backwards incompatible, but means Exim no longer needs to track
945all algorithms and provide string forms for them. */
83da1223 946
17c76198 947want_default_priorities = TRUE;
83da1223 948
17c76198 949if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 950 {
17c76198
PP
951 if (!expand_check_tlsvar(tls_require_ciphers))
952 return DEFER;
953 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 954 {
17c76198
PP
955 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
956 state->exp_tls_require_ciphers);
957
958 rc = gnutls_priority_init(&state->priority_cache,
959 CS state->exp_tls_require_ciphers, &errpos);
960 want_default_priorities = FALSE;
961 p = state->exp_tls_require_ciphers;
83da1223
PH
962 }
963 }
17c76198
PP
964if (want_default_priorities)
965 {
83e2f8a2
PP
966 DEBUG(D_tls)
967 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
968 exim_default_gnutls_priority);
17c76198
PP
969 rc = gnutls_priority_init(&state->priority_cache,
970 exim_default_gnutls_priority, &errpos);
971 p = US exim_default_gnutls_priority;
972 }
83da1223 973
17c76198
PP
974exim_gnutls_err_check(string_sprintf(
975 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
976 p, errpos - CS p, errpos));
977
978rc = gnutls_priority_set(state->session, state->priority_cache);
979exim_gnutls_err_check(US"gnutls_priority_set");
980
981gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
982
983/* Reduce security in favour of increased compatibility, if the admin
984decides to make that trade-off. */
985if (gnutls_compat_mode)
83da1223 986 {
17c76198
PP
987#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
988 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
989 gnutls_session_enable_compatibility_mode(state->session);
990#else
991 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
992#endif
83da1223
PH
993 }
994
17c76198
PP
995*caller_state = state;
996/* needs to happen before callbacks during handshake */
997current_global_tls_state = state;
998return OK;
83da1223
PH
999}
1000
1001
1002
1003
1004/*************************************************
17c76198 1005* Extract peer information *
059ec3d9
PH
1006*************************************************/
1007
17c76198 1008/* Called from both server and client code.
4fe99a6c
PP
1009Only this is allowed to set state->peerdn and state->have_set_peerdn
1010and we use that to detect double-calls.
059ec3d9 1011
75fe387d
PP
1012NOTE: the state blocks last while the TLS connection is up, which is fine
1013for logging in the server side, but for the client side, we log after teardown
1014in src/deliver.c. While the session is up, we can twist about states and
1015repoint tls_* globals, but those variables used for logging or other variable
1016expansion that happens _after_ delivery need to have a longer life-time.
1017
1018So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1019doing this more than once per generation of a state context. We set them in
1020the state context, and repoint tls_* to them. After the state goes away, the
1021tls_* copies of the pointers remain valid and client delivery logging is happy.
1022
1023tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1024don't apply.
1025
059ec3d9 1026Arguments:
17c76198 1027 state exim_gnutls_state_st *
059ec3d9 1028
17c76198 1029Returns: OK/DEFER/FAIL
059ec3d9
PH
1030*/
1031
17c76198
PP
1032static int
1033peer_status(exim_gnutls_state_st *state)
059ec3d9 1034{
75fe387d 1035uschar cipherbuf[256];
17c76198 1036const gnutls_datum *cert_list;
75fe387d 1037int old_pool, rc;
17c76198 1038unsigned int cert_list_size = 0;
4fe99a6c
PP
1039gnutls_protocol_t protocol;
1040gnutls_cipher_algorithm_t cipher;
1041gnutls_kx_algorithm_t kx;
1042gnutls_mac_algorithm_t mac;
17c76198
PP
1043gnutls_certificate_type_t ct;
1044gnutls_x509_crt_t crt;
4fe99a6c 1045uschar *p, *dn_buf;
17c76198 1046size_t sz;
059ec3d9 1047
4fe99a6c 1048if (state->have_set_peerdn)
17c76198 1049 return OK;
4fe99a6c 1050state->have_set_peerdn = TRUE;
059ec3d9 1051
4fe99a6c 1052state->peerdn = NULL;
059ec3d9 1053
4fe99a6c
PP
1054/* tls_cipher */
1055cipher = gnutls_cipher_get(state->session);
1056protocol = gnutls_protocol_get_version(state->session);
1057mac = gnutls_mac_get(state->session);
1058kx = gnutls_kx_get(state->session);
1059
75fe387d 1060string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1061 "%s:%s:%d",
1062 gnutls_protocol_get_name(protocol),
1063 gnutls_cipher_suite_get_name(kx, cipher, mac),
1064 (int) gnutls_cipher_get_key_size(cipher) * 8);
1065
1066/* I don't see a way that spaces could occur, in the current GnuTLS
1067code base, but it was a concern in the old code and perhaps older GnuTLS
1068releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1069for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1070 if (isspace(*p))
1071 *p = '-';
75fe387d
PP
1072old_pool = store_pool;
1073store_pool = POOL_PERM;
1074state->ciphersuite = string_copy(cipherbuf);
1075store_pool = old_pool;
1076tls_cipher = state->ciphersuite;
4fe99a6c
PP
1077
1078/* tls_peerdn */
17c76198 1079cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1080
17c76198
PP
1081if (cert_list == NULL || cert_list_size == 0)
1082 {
17c76198
PP
1083 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1084 cert_list, cert_list_size);
1085 if (state->verify_requirement == VERIFY_REQUIRED)
1086 return tls_error(US"certificate verification failed",
1087 "no certificate received from peer", state->host);
1088 return OK;
1089 }
059ec3d9 1090
17c76198
PP
1091ct = gnutls_certificate_type_get(state->session);
1092if (ct != GNUTLS_CRT_X509)
059ec3d9 1093 {
17c76198 1094 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1095 DEBUG(D_tls)
1096 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1097 if (state->verify_requirement == VERIFY_REQUIRED)
1098 return tls_error(US"certificate verification not possible, unhandled type",
1099 ctn, state->host);
1100 return OK;
83da1223 1101 }
059ec3d9 1102
17c76198
PP
1103#define exim_gnutls_peer_err(Label) do { \
1104 if (rc != GNUTLS_E_SUCCESS) { \
1105 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1106 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1107 return OK; } } while (0)
1108
1109rc = gnutls_x509_crt_init(&crt);
1110exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1111
1112rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1113exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1114sz = 0;
1115rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1116if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1117 {
17c76198
PP
1118 exim_gnutls_peer_err(US"getting size for cert DN failed");
1119 return FAIL; /* should not happen */
059ec3d9 1120 }
17c76198
PP
1121dn_buf = store_get_perm(sz);
1122rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1123exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1124state->peerdn = dn_buf;
1125
1126return OK;
1127#undef exim_gnutls_peer_err
1128}
059ec3d9 1129
059ec3d9 1130
059ec3d9 1131
059ec3d9 1132
17c76198
PP
1133/*************************************************
1134* Verify peer certificate *
1135*************************************************/
059ec3d9 1136
17c76198
PP
1137/* Called from both server and client code.
1138*Should* be using a callback registered with
1139gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1140the peer information, but that's too new for some OSes.
059ec3d9 1141
17c76198
PP
1142Arguments:
1143 state exim_gnutls_state_st *
1144 error where to put an error message
059ec3d9 1145
17c76198
PP
1146Returns:
1147 FALSE if the session should be rejected
1148 TRUE if the cert is okay or we just don't care
1149*/
059ec3d9 1150
17c76198
PP
1151static BOOL
1152verify_certificate(exim_gnutls_state_st *state, const char **error)
1153{
1154int rc;
1155unsigned int verify;
1156
1157*error = NULL;
1158
1159rc = peer_status(state);
1160if (rc != OK)
e6060e2c 1161 {
17c76198
PP
1162 verify = GNUTLS_CERT_INVALID;
1163 *error = "not supplied";
1164 }
1165else
1166 {
1167 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c
NM
1168 }
1169
17c76198
PP
1170/* Handle the result of verification. INVALID seems to be set as well
1171as REVOKED, but leave the test for both. */
059ec3d9 1172
17c76198
PP
1173if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1174 {
1175 state->peer_cert_verified = FALSE;
1176 if (*error == NULL)
1177 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
059ec3d9 1178
17c76198
PP
1179 DEBUG(D_tls)
1180 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
4fe99a6c 1181 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1182
17c76198
PP
1183 if (state->verify_requirement == VERIFY_REQUIRED)
1184 {
1185 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1186 return FALSE;
1187 }
1188 DEBUG(D_tls)
1189 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1190 }
1191else
1192 {
1193 state->peer_cert_verified = TRUE;
4fe99a6c
PP
1194 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1195 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1196 }
059ec3d9 1197
17c76198 1198tls_peerdn = state->peerdn;
059ec3d9 1199
17c76198
PP
1200return TRUE;
1201}
059ec3d9 1202
17c76198
PP
1203
1204
1205
1206/* ------------------------------------------------------------------------ */
1207/* Callbacks */
1208
1209/* Logging function which can be registered with
1210 * gnutls_global_set_log_function()
1211 * gnutls_global_set_log_level() 0..9
1212 */
af3498d6 1213#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1214static void
17c76198 1215exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1216{
8c79eebf
PP
1217 size_t len = strlen(message);
1218 if (len < 1)
1219 {
1220 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1221 return;
1222 }
1223 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1224 message[len-1] == '\n' ? "" : "\n");
17c76198 1225}
af3498d6 1226#endif
059ec3d9 1227
059ec3d9 1228
17c76198
PP
1229/* Called after client hello, should handle SNI work.
1230This will always set tls_sni (state->received_sni) if available,
1231and may trigger presenting different certificates,
1232if state->trigger_sni_changes is TRUE.
059ec3d9 1233
17c76198
PP
1234Should be registered with
1235 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1236
17c76198
PP
1237"This callback must return 0 on success or a gnutls error code to terminate the
1238handshake.".
059ec3d9 1239
17c76198
PP
1240For inability to get SNI information, we return 0.
1241We only return non-zero if re-setup failed.
1242*/
44bbabb5 1243
17c76198
PP
1244static int
1245exim_sni_handling_cb(gnutls_session_t session)
1246{
1247char sni_name[MAX_HOST_LEN];
1248size_t data_len = MAX_HOST_LEN;
1249exim_gnutls_state_st *state = current_global_tls_state;
1250unsigned int sni_type;
1251int rc, old_pool;
1252
1253rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1254if (rc != GNUTLS_E_SUCCESS)
1255 {
1256 DEBUG(D_tls) {
1257 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1258 debug_printf("TLS: no SNI presented in handshake.\n");
1259 else
1260 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1261 gnutls_strerror(rc), rc);
1262 };
1263 return 0;
1264 }
1265
17c76198
PP
1266if (sni_type != GNUTLS_NAME_DNS)
1267 {
1268 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1269 return 0;
1270 }
44bbabb5 1271
17c76198
PP
1272/* We now have a UTF-8 string in sni_name */
1273old_pool = store_pool;
1274store_pool = POOL_PERM;
1275state->received_sni = string_copyn(US sni_name, data_len);
1276store_pool = old_pool;
1277
1278/* We set this one now so that variable expansions below will work */
1279tls_sni = state->received_sni;
1280
1281DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1282 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1283
1284if (!state->trigger_sni_changes)
1285 return 0;
1286
1287rc = tls_expand_session_files(state);
1288if (rc != OK)
1289 {
1290 /* If the setup of certs/etc failed before handshake, TLS would not have
1291 been offered. The best we can do now is abort. */
1292 return GNUTLS_E_APPLICATION_ERROR_MIN;
1293 }
1294
1365611d
PP
1295rc = tls_set_remaining_x509(state);
1296if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1297
1298return 0;
059ec3d9
PH
1299}
1300
1301
1302
17c76198
PP
1303
1304/* ------------------------------------------------------------------------ */
1305/* Exported functions */
1306
1307
1308
1309
059ec3d9
PH
1310/*************************************************
1311* Start a TLS session in a server *
1312*************************************************/
1313
1314/* This is called when Exim is running as a server, after having received
1315the STARTTLS command. It must respond to that command, and then negotiate
1316a TLS session.
1317
1318Arguments:
83da1223 1319 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1320
1321Returns: OK on success
1322 DEFER for errors before the start of the negotiation
1323 FAIL for errors during the negotation; the server can't
1324 continue running.
1325*/
1326
1327int
17c76198 1328tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1329{
1330int rc;
7199e1ee 1331const char *error;
17c76198 1332exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1333
1334/* Check for previous activation */
17c76198 1335/* nb: this will not be TLS callout safe, needs reworking as part of that. */
059ec3d9
PH
1336
1337if (tls_active >= 0)
1338 {
17c76198 1339 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1340 smtp_printf("554 Already in TLS\r\n");
1341 return FAIL;
1342 }
1343
1344/* Initialize the library. If it fails, it will already have logged the error
1345and sent an SMTP response. */
1346
17c76198 1347DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1348
17c76198
PP
1349rc = tls_init(NULL, tls_certificate, tls_privatekey,
1350 NULL, tls_verify_certificates, tls_crl,
1351 require_ciphers, &state);
059ec3d9
PH
1352if (rc != OK) return rc;
1353
059ec3d9
PH
1354/* If this is a host for which certificate verification is mandatory or
1355optional, set up appropriately. */
1356
059ec3d9 1357if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1358 {
1359 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1360 state->verify_requirement = VERIFY_REQUIRED;
1361 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1362 }
059ec3d9 1363else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1364 {
1365 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1366 state->verify_requirement = VERIFY_OPTIONAL;
1367 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1368 }
1369else
1370 {
1371 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1372 state->verify_requirement = VERIFY_NONE;
1373 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1374 }
059ec3d9 1375
17c76198
PP
1376/* Register SNI handling; always, even if not in tls_certificate, so that the
1377expansion variable $tls_sni is always available. */
059ec3d9 1378
17c76198
PP
1379gnutls_handshake_set_post_client_hello_function(state->session,
1380 exim_sni_handling_cb);
059ec3d9
PH
1381
1382/* Set context and tell client to go ahead, except in the case of TLS startup
1383on connection, where outputting anything now upsets the clients and tends to
1384make them disconnect. We need to have an explicit fflush() here, to force out
1385the response. Other smtp_printf() calls do not need it, because in non-TLS
1386mode, the fflush() happens when smtp_getc() is called. */
1387
1388if (!tls_on_connect)
1389 {
1390 smtp_printf("220 TLS go ahead\r\n");
1391 fflush(smtp_out);
1392 }
1393
1394/* Now negotiate the TLS session. We put our own timer on it, since it seems
1395that the GnuTLS library doesn't. */
1396
17c76198
PP
1397gnutls_transport_set_ptr2(state->session,
1398 (gnutls_transport_ptr)fileno(smtp_in),
1399 (gnutls_transport_ptr)fileno(smtp_out));
1400state->fd_in = fileno(smtp_in);
1401state->fd_out = fileno(smtp_out);
059ec3d9
PH
1402
1403sigalrm_seen = FALSE;
1404if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1405do
1406 {
1407 rc = gnutls_handshake(state->session);
619b2b25
PP
1408 } while ((rc == GNUTLS_E_AGAIN) ||
1409 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1410alarm(0);
1411
17c76198 1412if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1413 {
17c76198
PP
1414 tls_error(US"gnutls_handshake",
1415 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1416 /* It seems that, except in the case of a timeout, we have to close the
1417 connection right here; otherwise if the other end is running OpenSSL it hangs
1418 until the server times out. */
1419
1420 if (!sigalrm_seen)
1421 {
f1e894f3
PH
1422 (void)fclose(smtp_out);
1423 (void)fclose(smtp_in);
059ec3d9
PH
1424 }
1425
1426 return FAIL;
1427 }
1428
1429DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1430
17c76198
PP
1431/* Verify after the fact */
1432
1433if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1434 {
17c76198
PP
1435 if (!verify_certificate(state, &error))
1436 {
1437 if (state->verify_requirement == VERIFY_OPTIONAL)
1438 {
1439 DEBUG(D_tls)
1440 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1441 error);
1442 }
1443 else
1444 {
1445 tls_error(US"certificate verification failed", error, NULL);
1446 return FAIL;
1447 }
1448 }
059ec3d9
PH
1449 }
1450
17c76198
PP
1451/* Figure out peer DN, and if authenticated, etc. */
1452
1453rc = peer_status(state);
1454if (rc != OK) return rc;
1455
1456/* Sets various Exim expansion variables; always safe within server */
1457
1458extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1459
1460/* TLS has been set up. Adjust the input functions to read via TLS,
1461and initialize appropriately. */
1462
17c76198 1463state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1464
1465receive_getc = tls_getc;
1466receive_ungetc = tls_ungetc;
1467receive_feof = tls_feof;
1468receive_ferror = tls_ferror;
58eb016e 1469receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1470
059ec3d9
PH
1471return OK;
1472}
1473
1474
1475
1476
1477/*************************************************
1478* Start a TLS session in a client *
1479*************************************************/
1480
1481/* Called from the smtp transport after STARTTLS has been accepted.
1482
1483Arguments:
1484 fd the fd of the connection
1485 host connected host (for messages)
83da1223 1486 addr the first address (not used)
17c76198 1487 dhparam DH parameter file (ignored, we're a client)
059ec3d9
PH
1488 certificate certificate file
1489 privatekey private key file
3f0945ff 1490 sni TLS SNI to send to remote host
059ec3d9
PH
1491 verify_certs file for certificate verify
1492 verify_crl CRL for verify
83da1223 1493 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1494 timeout startup timeout
1495
1496Returns: OK/DEFER/FAIL (because using common functions),
1497 but for a client, DEFER and FAIL have the same meaning
1498*/
1499
1500int
17c76198
PP
1501tls_client_start(int fd, host_item *host,
1502 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1503 uschar *certificate, uschar *privatekey, uschar *sni,
1504 uschar *verify_certs, uschar *verify_crl,
1505 uschar *require_ciphers, int timeout)
059ec3d9 1506{
059ec3d9 1507int rc;
17c76198
PP
1508const char *error;
1509exim_gnutls_state_st *state = NULL;
059ec3d9 1510
17c76198 1511DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1512
17c76198
PP
1513rc = tls_init(host, certificate, privatekey,
1514 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1515if (rc != OK) return rc;
1516
17c76198 1517gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
83da1223 1518
17c76198
PP
1519if (verify_certs == NULL)
1520 {
1521 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1522 state->verify_requirement = VERIFY_NONE;
1523 /* we still ask for it, to log it, etc */
1524 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1525 }
1526else
1527 {
1528 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1529 state->verify_requirement = VERIFY_REQUIRED;
1530 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1531 }
059ec3d9 1532
17c76198
PP
1533gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1534state->fd_in = fd;
1535state->fd_out = fd;
059ec3d9
PH
1536
1537/* There doesn't seem to be a built-in timeout on connection. */
1538
1539sigalrm_seen = FALSE;
1540alarm(timeout);
17c76198
PP
1541do
1542 {
1543 rc = gnutls_handshake(state->session);
619b2b25
PP
1544 } while ((rc == GNUTLS_E_AGAIN) ||
1545 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1546alarm(0);
1547
4fe99a6c
PP
1548if (rc != GNUTLS_E_SUCCESS)
1549 return tls_error(US"gnutls_handshake",
1550 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1551
17c76198 1552DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1553
17c76198 1554/* Verify late */
059ec3d9 1555
17c76198
PP
1556if (state->verify_requirement != VERIFY_NONE &&
1557 !verify_certificate(state, &error))
1558 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1559
17c76198 1560/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1561
17c76198
PP
1562rc = peer_status(state);
1563if (rc != OK) return rc;
059ec3d9 1564
4fe99a6c 1565/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1566
17c76198 1567extract_exim_vars_from_tls_state(state);
059ec3d9 1568
059ec3d9
PH
1569return OK;
1570}
1571
1572
1573
17c76198 1574
059ec3d9 1575/*************************************************
17c76198 1576* Close down a TLS session *
059ec3d9
PH
1577*************************************************/
1578
17c76198
PP
1579/* This is also called from within a delivery subprocess forked from the
1580daemon, to shut down the TLS library, without actually doing a shutdown (which
1581would tamper with the TLS session in the parent process).
059ec3d9 1582
17c76198
PP
1583Arguments: TRUE if gnutls_bye is to be called
1584Returns: nothing
059ec3d9
PH
1585*/
1586
17c76198
PP
1587void
1588tls_close(BOOL shutdown)
059ec3d9 1589{
17c76198 1590exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1591
17c76198
PP
1592if (tls_active < 0) return; /* TLS was not active */
1593
1594if (shutdown)
1595 {
1596 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1597 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1598 }
1599
1600gnutls_deinit(state->session);
1601
1602memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1603
1604if ((state_server.session == NULL) && (state_client.session == NULL))
1605 {
1606 gnutls_global_deinit();
1607 exim_gnutls_base_init_done = FALSE;
1608 }
7199e1ee 1609
17c76198 1610tls_active = -1;
059ec3d9
PH
1611}
1612
1613
1614
17c76198 1615
059ec3d9
PH
1616/*************************************************
1617* TLS version of getc *
1618*************************************************/
1619
1620/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1621it refills the buffer via the GnuTLS reading function.
1622
17c76198
PP
1623This feeds DKIM and should be used for all message-body reads.
1624
059ec3d9
PH
1625Arguments: none
1626Returns: the next character or EOF
1627*/
1628
1629int
1630tls_getc(void)
1631{
17c76198
PP
1632exim_gnutls_state_st *state = current_global_tls_state;
1633if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1634 {
17c76198 1635 ssize_t inbytes;
059ec3d9 1636
17c76198
PP
1637 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1638 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1639
1640 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1641 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1642 ssl_xfer_buffer_size);
1643 alarm(0);
1644
1645 /* A zero-byte return appears to mean that the TLS session has been
1646 closed down, not that the socket itself has been closed down. Revert to
1647 non-TLS handling. */
1648
1649 if (inbytes == 0)
1650 {
1651 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1652
1653 receive_getc = smtp_getc;
1654 receive_ungetc = smtp_ungetc;
1655 receive_feof = smtp_feof;
1656 receive_ferror = smtp_ferror;
58eb016e 1657 receive_smtp_buffered = smtp_buffered;
059ec3d9 1658
17c76198
PP
1659 gnutls_deinit(state->session);
1660 state->session = NULL;
059ec3d9 1661 tls_active = -1;
17c76198
PP
1662 tls_bits = 0;
1663 tls_certificate_verified = FALSE;
1664 tls_channelbinding_b64 = NULL;
059ec3d9
PH
1665 tls_cipher = NULL;
1666 tls_peerdn = NULL;
1667
1668 return smtp_getc();
1669 }
1670
1671 /* Handle genuine errors */
1672
1673 else if (inbytes < 0)
1674 {
17c76198
PP
1675 record_io_error(state, (int) inbytes, US"recv", NULL);
1676 state->xfer_error = 1;
059ec3d9
PH
1677 return EOF;
1678 }
80a47a2c 1679#ifndef DISABLE_DKIM
17c76198 1680 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1681#endif
17c76198
PP
1682 state->xfer_buffer_hwm = (int) inbytes;
1683 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1684 }
1685
059ec3d9
PH
1686/* Something in the buffer; return next uschar */
1687
17c76198 1688return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1689}
1690
1691
1692
17c76198 1693
059ec3d9
PH
1694/*************************************************
1695* Read bytes from TLS channel *
1696*************************************************/
1697
17c76198
PP
1698/* This does not feed DKIM, so if the caller uses this for reading message body,
1699then the caller must feed DKIM.
059ec3d9
PH
1700Arguments:
1701 buff buffer of data
1702 len size of buffer
1703
1704Returns: the number of bytes read
1705 -1 after a failed read
1706*/
1707
1708int
1709tls_read(uschar *buff, size_t len)
1710{
17c76198
PP
1711exim_gnutls_state_st *state = current_global_tls_state;
1712ssize_t inbytes;
059ec3d9 1713
17c76198
PP
1714if (len > INT_MAX)
1715 len = INT_MAX;
059ec3d9 1716
17c76198
PP
1717if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1718 DEBUG(D_tls)
1719 debug_printf("*** PROBABLY A BUG *** " \
1720 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1721 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1722
1723DEBUG(D_tls)
1724 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1725 state->session, buff, len);
1726
1727inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1728if (inbytes > 0) return inbytes;
1729if (inbytes == 0)
1730 {
1731 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1732 }
17c76198 1733else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1734
1735return -1;
1736}
1737
1738
1739
17c76198 1740
059ec3d9
PH
1741/*************************************************
1742* Write bytes down TLS channel *
1743*************************************************/
1744
1745/*
1746Arguments:
1747 buff buffer of data
1748 len number of bytes
1749
1750Returns: the number of bytes after a successful write,
1751 -1 after a failed write
1752*/
1753
1754int
1755tls_write(const uschar *buff, size_t len)
1756{
17c76198
PP
1757ssize_t outbytes;
1758size_t left = len;
1759exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1760
17c76198 1761DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1762while (left > 0)
1763 {
17c76198
PP
1764 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1765 buff, left);
1766 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1767
17c76198 1768 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1769 if (outbytes < 0)
1770 {
17c76198 1771 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1772 return -1;
1773 }
1774 if (outbytes == 0)
1775 {
17c76198 1776 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1777 return -1;
1778 }
1779
1780 left -= outbytes;
1781 buff += outbytes;
1782 }
1783
17c76198
PP
1784if (len > INT_MAX)
1785 {
1786 DEBUG(D_tls)
1787 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1788 len);
1789 len = INT_MAX;
1790 }
1791
1792return (int) len;
059ec3d9
PH
1793}
1794
1795
1796
17c76198 1797
059ec3d9 1798/*************************************************
17c76198 1799* Random number generation *
059ec3d9
PH
1800*************************************************/
1801
17c76198
PP
1802/* Pseudo-random number generation. The result is not expected to be
1803cryptographically strong but not so weak that someone will shoot themselves
1804in the foot using it as a nonce in input in some email header scheme or
1805whatever weirdness they'll twist this into. The result should handle fork()
1806and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1807
17c76198
PP
1808Arguments:
1809 max range maximum
1810Returns a random number in range [0, max-1]
059ec3d9
PH
1811*/
1812
af3498d6 1813#ifdef HAVE_GNUTLS_RND
17c76198
PP
1814int
1815vaguely_random_number(int max)
059ec3d9 1816{
17c76198
PP
1817unsigned int r;
1818int i, needed_len;
1819uschar *p;
1820uschar smallbuf[sizeof(r)];
1821
1822if (max <= 1)
1823 return 0;
1824
1825needed_len = sizeof(r);
1826/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1827 * asked for a number less than 10. */
1828for (r = max, i = 0; r; ++i)
1829 r >>= 1;
1830i = (i + 7) / 8;
1831if (i < needed_len)
1832 needed_len = i;
1833
1834i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1835if (i < 0)
059ec3d9 1836 {
17c76198
PP
1837 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1838 return vaguely_random_number_fallback(max);
1839 }
1840r = 0;
1841for (p = smallbuf; needed_len; --needed_len, ++p)
1842 {
1843 r *= 256;
1844 r += *p;
059ec3d9
PH
1845 }
1846
17c76198
PP
1847/* We don't particularly care about weighted results; if someone wants
1848 * smooth distribution and cares enough then they should submit a patch then. */
1849return r % max;
059ec3d9 1850}
af3498d6
PP
1851#else /* HAVE_GNUTLS_RND */
1852int
1853vaguely_random_number(int max)
1854{
1855 return vaguely_random_number_fallback(max);
1856}
1857#endif /* HAVE_GNUTLS_RND */
059ec3d9 1858
36f12725
NM
1859
1860
1861
1862/*************************************************
3375e053
PP
1863* Let tls_require_ciphers be checked at startup *
1864*************************************************/
1865
1866/* The tls_require_ciphers option, if set, must be something which the
1867library can parse.
1868
1869Returns: NULL on success, or error message
1870*/
1871
1872uschar *
1873tls_validate_require_cipher(void)
1874{
1875int rc;
1876uschar *expciphers = NULL;
1877gnutls_priority_t priority_cache;
1878const char *errpos;
1879
1880#define validate_check_rc(Label) do { \
1881 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1882 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1883#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1884
1885if (exim_gnutls_base_init_done)
1886 log_write(0, LOG_MAIN|LOG_PANIC,
1887 "already initialised GnuTLS, Exim developer bug");
1888
1889rc = gnutls_global_init();
1890validate_check_rc(US"gnutls_global_init()");
1891exim_gnutls_base_init_done = TRUE;
1892
1893if (!(tls_require_ciphers && *tls_require_ciphers))
1894 return_deinit(NULL);
1895
1896if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1897 return_deinit(US"failed to expand tls_require_ciphers");
1898
1899if (!(expciphers && *expciphers))
1900 return_deinit(NULL);
1901
1902DEBUG(D_tls)
1903 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1904
1905rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1906validate_check_rc(string_sprintf(
1907 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1908 expciphers, errpos - CS expciphers, errpos));
1909
1910#undef return_deinit
1911#undef validate_check_rc
1912gnutls_global_deinit();
1913
1914return NULL;
1915}
1916
1917
1918
1919
1920/*************************************************
36f12725
NM
1921* Report the library versions. *
1922*************************************************/
1923
1924/* See a description in tls-openssl.c for an explanation of why this exists.
1925
1926Arguments: a FILE* to print the results to
1927Returns: nothing
1928*/
1929
1930void
1931tls_version_report(FILE *f)
1932{
754a0503
PP
1933fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1934 " Runtime: %s\n",
1935 LIBGNUTLS_VERSION,
1936 gnutls_check_version(NULL));
36f12725
NM
1937}
1938
059ec3d9 1939/* End of tls-gnu.c */